If this is your first visit, be sure to
check out the FAQ by clicking the
link above. You may have to register
before you can post: click the register link above to proceed. To start viewing messages,
select the forum that you want to visit from the selection below.

IIS 5.1 on Windows XP

I don't know how many ouf you guys are running IIS 5.1 on Windows XP to host sites but, I figured I'd run a couple things by you guys who are.
For starters, I'm running an Intranet website using IIS 5.1 on XP. We have (2) 2003 Server DC's but, it's not good practice to setup your IIS on your DC's.(simply because you don't want to chance exposing your DC's any more than you have to). So we took an old XP box and setup it up there.
It works fine but, I learned a few tricks along the way that I'm not sure you guys may know of. My guess is that you already know about the IIS Lockdown tool (if not, go here ). Also, by default, IIS 5.1 (which comes with XP) is defaulted to only allow 10 connections (other users will get an error if they attempt to connect past that limit). If you download MetaEdit 2.2, you can edit the metabase key MaxConnections for W3SVC and set it to anything less than 40.
As I keep learning more tip and/or tricks, I'll let you guys know.

I almost forgot to mention that snapfile has some IIS add-ons. One I was interetsed in was the IIS Password but after reading the EULA, it seemed that it came bundled with adware. Check it out and see what you think SnapFiles IIS Add-Ons

The object of war is not to die for your country but to make the other bastard die for his - George Patton

One of the more important things is updates... but that's true of anything... There are a lot of canned exploits in existance for IIS.... not only that.. but updates for any web apps it's running... These are key... web apps are a common area of entrance for malicious people... If you're running custom apps on it.. make sure you have a proper code audit done...

I also highly recommend disabling WebDav... IISLockdown can assist with that.

Peace,
HT

IT Blog: .:Computer Defense:.PnCHd (Pronounced Pinched): Acronym - Point 'n Click Hacked. As in: "That website was pinched" or "The skiddie pinched my computer because I forgot to patch".

Computernerd22,
I'm only running HTTP for my IIS. I didn't install the FTP/SMTP options because I don't need those services. The Intranet this box is hosting is simply for referencing files on the LAN and/or specific site links. I already ran the IIS Lockdown tool because it's highly recommended (I do believe I had mentioned the IIS Lockdown tool and provided a link for it in my previous post ((and like HTRegz said, URLScan does indeed come with the IIS Lockdown tool)). In any event, should you find anything else, let me know as I will share anything I find as well.

The object of war is not to die for your country but to make the other bastard die for his - George Patton